{"id":"CVE-2026-111240","aliases":["EUVD-2026-121255","GHSA-p76p-57cv-p5qw"],"status":"published","title":"Apache TomEE: Authentication bypass for accounts without a stored password in SQL login module","description":"The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deployments using this login module with NULL passwords in the user table are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","epss":{"day":"2026-11-12","score":0.00182,"percentile":0.07871,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2026-11-10T15:30:28Z","modified":"2026-11-10T18:31:45Z","products":[{"vendor":"apache software foundation","product":"apache tomee"}],"references":[{"url":"https://lists.apache.org/thread/1w1olwsbzpsj7mnv8v3vj30ohq0t0c52","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111240"},{"url":"https://github.com/advisories/GHSA-p76p-57cv-p5qw"}],"sources":{"cve":[{"id":"CVE-2026-111240","title":"Apache TomEE: Authentication bypass for accounts without a stored password in SQL login module","description":"The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deployments using this login module with NULL passwords in the user table are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","status":"published","published":"2026-11-10T15:30:28.843Z","modified":"2026-11-10T15:30:28.843Z","cwes":["CWE-287"],"updated_at":"2026-11-10T16:39:23.649176Z"}],"euvd":[{"id":"EUVD-2026-121255","description":"The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deployments using this login module with NULL passwords in the user table are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","status":"published","published":"2026-11-10T15:30:28Z","modified":"2026-11-10T15:30:28Z","updated_at":"2026-11-10T20:23:11.353031Z"}],"ghsa":[{"id":"GHSA-p76p-57cv-p5qw","title":"The JDBC based JAAS login module accepts a login without a password for accounts whose stored...","description":"The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deployments using this login module with NULL passwords in the user table are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","status":"published","published":"2026-11-10T18:31:37Z","modified":"2026-11-10T18:31:45Z","cwes":["CWE-287"],"updated_at":"2026-11-10T18:56:09.133019Z"}],"nvd":[{"id":"CVE-2026-111240","description":"The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deployments using this login module with NULL passwords in the user table are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","status":"published","published":"2026-11-10T16:17:14.723Z","modified":"2026-11-12T17:06:26.857Z","cwes":["CWE-287"],"updated_at":"2026-11-10T18:20:10.790002Z"}]}}